Re: [Full-Disclosure] PGP vs. certificate from Verisign

From: Ben Laurie (ben_at_algroup.co.uk)
Date: 05/10/03

  • Next message: yossarian: "Re: [Full-Disclosure] PGP vs. certificate from Verisign"
    To: Steve Poirot <poirotsj@gci.net>
    Date: Sat, 10 May 2003 21:03:40 +0100
    

    Steve Poirot wrote:
    > I'm 98% sure that the key pair is generated on the client machine and
    > that just the public key is transmitted to the CA. The reason I say 98%
    > instead of 100% is that it's possible that a CA just makes it look like
    > that's what's happening. This could be verified by sniffing the session.

    Well, the amusing thing is you can do it either way. As it happens
    neither Thawte nor Verisign (yeah, OK, they're the same thing) have sold
    out enough to generate private keys.

    I still hear people telling me occasionally that there are sound reasons
    for having the CA generate the private key. Strangely they never quite
    get round to specifying what those reasons are.

    Cheers,

    Ben.

    -- 
    http://www.apache-ssl.org/ben.html       http://www.thebunker.net/
    "There is no limit to what a man can do or how far he can go if he
    doesn't mind who gets the credit." - Robert Woodruff
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    

  • Next message: yossarian: "Re: [Full-Disclosure] PGP vs. certificate from Verisign"